VIR Vulnerability Intelligence Relay

CVE-2012-5496

medium
Published 2014-09-30 · Modified 2023-11-08
CVSS v3
—
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v2
5.0
VIR risk
5.0

Description

kupu_spellcheck.py in Kupu in Plone before 4.0 allows remote attackers to cause a denial of service (ZServer thread lock) via a crafted URL.

Predictions

Exploit likelihood
30%
Patch ETA
—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

vendor Authored 2026-05-27

Vendor advisory: secalert@redhat.com — https://plone.org/products/plone/security/advisories/20121106/12

vendor Authored 2026-05-27

Vendor advisory: secalert@redhat.com — https://plone.org/products/plone-hotfix/releases/20121106

Package impact
EcosystemPackageVulnerableFixed
python PyPIplone<4.04.0
python PyPIplone<3.3.63.3.6

Application impact
VendorProductVersionsFixed
ploneplone{"endIncluding":"3.3.5"}
ploneplone1.0
ploneplone1.0.1
ploneplone1.0.2
ploneplone1.0.3
ploneplone1.0.4
ploneplone1.0.5
ploneplone1.0.6
ploneplone2.0
ploneplone2.0.1
ploneplone2.0.2
ploneplone2.0.3
ploneplone2.0.4
ploneplone2.0.5
ploneplone2.1
ploneplone2.1.1
ploneplone2.1.2
ploneplone2.1.3
ploneplone2.1.4
ploneplone2.5
ploneplone2.5.1
ploneplone2.5.2
ploneplone2.5.3
ploneplone2.5.4
ploneplone2.5.5
ploneplone3.0
ploneplone3.0.1
ploneplone3.0.2
ploneplone3.0.3
ploneplone3.0.4
ploneplone3.0.5
ploneplone3.0.6
ploneplone3.1
ploneplone3.1.1
ploneplone3.1.2
ploneplone3.1.3
ploneplone3.1.4
ploneplone3.1.5.1
ploneplone3.1.6
ploneplone3.1.7
ploneplone3.2
ploneplone3.2.1
ploneplone3.2.2
ploneplone3.2.3
ploneplone3.3
ploneplone3.3.1
ploneplone3.3.2
ploneplone3.3.3
ploneplone3.3.4

References

CWEs

CWE-399

Verify integrity in audit chain (admin only). AS-IS.